fix(gh-aw): correct exact enlistment compiler warning gate

.changeset/gh-aw-native-review-warning.md

@@ -0,0 +1,6 @@
+---
+"@bradygaster/squad-cli": patch
+"@bradygaster/squad-sdk": patch
+---
+
+Correct the enlistment skill's strict compile gate for gh-aw v0.89.21 to accept only the exact native review advisory and bot-trigger warning. Preserve all reviewer controls, human approval, and hard stops for errors or any unexpected warning.

.squad-templates/skills/gh-aw-enlistment/SKILL.md

@@ -222,11 +222,33 @@ This must run after any first-install approval and before committing. Success
 criteria:
 
 - All eight workflows compile successfully.
-- The **only** permitted warning is the known `squad.md` bot-trigger warning: it
-  configures both slash-command and `github-actions[bot]` triggers, and the bot
-  trigger is required for controlled worker-continuation dispatches.
-- **STOP** on any error, or on **any additional warning** beyond that single
-  documented one.
+- With gh-aw v0.89.21, require exactly two warnings, one occurrence of each
+  exact diagnostic header below (including its workflow path):
+
+<!-- compile-warning-allowlist-start -->
+```text
+.github/workflows/squad-review.md: warning: pull_request_target is a very dangerous trigger.
+.github/workflows/squad.md: warning: Both slash_command and bots triggers are configured. If a bot listed in bots: posts a comment that starts with the slash command text (e.g., /command-name), it will trigger the workflow and occupy the concurrency slot, potentially blocking simultaneous manual invocations. To ensure the workflow only runs on explicit user commands, remove the 'bots:' field.
+```
+<!-- compile-warning-allowlist-end -->
+
+The native review advisory includes the compiler's standard explanation and
+Security Lab link. The following guard-policy dry-run lines are informational,
+not another warning. The bot-trigger warning is expected because
+`github-actions[bot]` enables controlled worker-continuation dispatches.
+
+Accept the native review advisory **only while all existing controls remain**:
+same-repository head restriction, base-controlled workflow source,
+`checkout: false` agent path, API-only inspection, exact run/head/attempt guard,
+least-privilege jobs, advisory verdict, and independent human approval.
+`pull_request_target` is not generally safe; this narrow exception neither
+weakens those controls nor authorizes PR-head execution.
+
+**STOP** on any error, or on **any additional warning** beyond these two exact
+documented diagnostics. Also STOP if either warning is missing, duplicated,
+changed, or attributed to another path, if the summary is not
+`Compiled 8 workflows: 8 succeeded, 2 warnings`, or if any required control is
+absent. Do not suppress warnings or use `--approve` to bypass this gate.
 
 ### 6. Require the verifier to prove the complete consumer contract
 

docs/src/content/docs/guide/gh-aw.md

@@ -341,10 +341,34 @@ gh aw compile --strict
 ```
 
 Run this exact command after any required first-install approval and before
-committing. It must report all eight workflows succeeded. `squad.md` currently
-emits one known warning because both slash-command and `github-actions[bot]`
-triggers are configured; the bot trigger is required for controlled worker
-continuation dispatches. Any error or any additional warning is a stop condition.
+committing. With gh-aw v0.89.21, require exactly two warnings, one occurrence
+of each exact diagnostic header below (including its workflow path):
+
+<!-- compile-warning-allowlist-start -->
+```text
+.github/workflows/squad-review.md: warning: pull_request_target is a very dangerous trigger.
+.github/workflows/squad.md: warning: Both slash_command and bots triggers are configured. If a bot listed in bots: posts a comment that starts with the slash command text (e.g., /command-name), it will trigger the workflow and occupy the concurrency slot, potentially blocking simultaneous manual invocations. To ensure the workflow only runs on explicit user commands, remove the 'bots:' field.
+```
+<!-- compile-warning-allowlist-end -->
+
+The native review advisory includes the compiler's standard explanation and
+Security Lab link. The following guard-policy dry-run lines are informational,
+not another warning. The bot-trigger warning is expected because `squad.md`
+configures both slash-command and `github-actions[bot]` triggers for controlled
+worker-continuation dispatches.
+
+Accept the native review advisory **only while all existing controls remain**:
+same-repository head restriction, base-controlled workflow source,
+`checkout: false` agent path, API-only inspection, exact run/head/attempt guard,
+least-privilege jobs, advisory verdict, and independent human approval.
+`pull_request_target` is not generally safe; this narrow exception neither
+weakens those controls nor authorizes PR-head execution.
+
+**STOP** on any error, or on **any additional warning** beyond these two exact
+documented diagnostics. Also STOP if either warning is missing, duplicated,
+changed, or attributed to another path, if the summary is not
+`Compiled 8 workflows: 8 succeeded, 2 warnings`, or if any required control is
+absent. Do not suppress warnings or use `--approve` to bypass this gate.
 
 Verify the complete source/lock surface:
 

packages/squad-cli/templates/skills/gh-aw-enlistment/SKILL.md

@@ -222,11 +222,33 @@ This must run after any first-install approval and before committing. Success
 criteria:
 
 - All eight workflows compile successfully.
-- The **only** permitted warning is the known `squad.md` bot-trigger warning: it
-  configures both slash-command and `github-actions[bot]` triggers, and the bot
-  trigger is required for controlled worker-continuation dispatches.
-- **STOP** on any error, or on **any additional warning** beyond that single
-  documented one.
+- With gh-aw v0.89.21, require exactly two warnings, one occurrence of each
+  exact diagnostic header below (including its workflow path):
+
+<!-- compile-warning-allowlist-start -->
+```text
+.github/workflows/squad-review.md: warning: pull_request_target is a very dangerous trigger.
+.github/workflows/squad.md: warning: Both slash_command and bots triggers are configured. If a bot listed in bots: posts a comment that starts with the slash command text (e.g., /command-name), it will trigger the workflow and occupy the concurrency slot, potentially blocking simultaneous manual invocations. To ensure the workflow only runs on explicit user commands, remove the 'bots:' field.
+```
+<!-- compile-warning-allowlist-end -->
+
+The native review advisory includes the compiler's standard explanation and
+Security Lab link. The following guard-policy dry-run lines are informational,
+not another warning. The bot-trigger warning is expected because
+`github-actions[bot]` enables controlled worker-continuation dispatches.
+
+Accept the native review advisory **only while all existing controls remain**:
+same-repository head restriction, base-controlled workflow source,
+`checkout: false` agent path, API-only inspection, exact run/head/attempt guard,
+least-privilege jobs, advisory verdict, and independent human approval.
+`pull_request_target` is not generally safe; this narrow exception neither
+weakens those controls nor authorizes PR-head execution.
+
+**STOP** on any error, or on **any additional warning** beyond these two exact
+documented diagnostics. Also STOP if either warning is missing, duplicated,
+changed, or attributed to another path, if the summary is not
+`Compiled 8 workflows: 8 succeeded, 2 warnings`, or if any required control is
+absent. Do not suppress warnings or use `--approve` to bypass this gate.
 
 ### 6. Require the verifier to prove the complete consumer contract
 

packages/squad-sdk/templates/skills/gh-aw-enlistment/SKILL.md

@@ -222,11 +222,33 @@ This must run after any first-install approval and before committing. Success
 criteria:
 
 - All eight workflows compile successfully.
-- The **only** permitted warning is the known `squad.md` bot-trigger warning: it
-  configures both slash-command and `github-actions[bot]` triggers, and the bot
-  trigger is required for controlled worker-continuation dispatches.
-- **STOP** on any error, or on **any additional warning** beyond that single
-  documented one.
+- With gh-aw v0.89.21, require exactly two warnings, one occurrence of each
+  exact diagnostic header below (including its workflow path):
+
+<!-- compile-warning-allowlist-start -->
+```text
+.github/workflows/squad-review.md: warning: pull_request_target is a very dangerous trigger.
+.github/workflows/squad.md: warning: Both slash_command and bots triggers are configured. If a bot listed in bots: posts a comment that starts with the slash command text (e.g., /command-name), it will trigger the workflow and occupy the concurrency slot, potentially blocking simultaneous manual invocations. To ensure the workflow only runs on explicit user commands, remove the 'bots:' field.
+```
+<!-- compile-warning-allowlist-end -->
+
+The native review advisory includes the compiler's standard explanation and
+Security Lab link. The following guard-policy dry-run lines are informational,
+not another warning. The bot-trigger warning is expected because
+`github-actions[bot]` enables controlled worker-continuation dispatches.
+
+Accept the native review advisory **only while all existing controls remain**:
+same-repository head restriction, base-controlled workflow source,
+`checkout: false` agent path, API-only inspection, exact run/head/attempt guard,
+least-privilege jobs, advisory verdict, and independent human approval.
+`pull_request_target` is not generally safe; this narrow exception neither
+weakens those controls nor authorizes PR-head execution.
+
+**STOP** on any error, or on **any additional warning** beyond these two exact
+documented diagnostics. Also STOP if either warning is missing, duplicated,
+changed, or attributed to another path, if the summary is not
+`Compiled 8 workflows: 8 succeeded, 2 warnings`, or if any required control is
+absent. Do not suppress warnings or use `--approve` to bypass this gate.
 
 ### 6. Require the verifier to prove the complete consumer contract
 

templates/skills/gh-aw-enlistment/SKILL.md

@@ -222,11 +222,33 @@ This must run after any first-install approval and before committing. Success
 criteria:
 
 - All eight workflows compile successfully.
-- The **only** permitted warning is the known `squad.md` bot-trigger warning: it
-  configures both slash-command and `github-actions[bot]` triggers, and the bot
-  trigger is required for controlled worker-continuation dispatches.
-- **STOP** on any error, or on **any additional warning** beyond that single
-  documented one.
+- With gh-aw v0.89.21, require exactly two warnings, one occurrence of each
+  exact diagnostic header below (including its workflow path):
+
+<!-- compile-warning-allowlist-start -->
+```text
+.github/workflows/squad-review.md: warning: pull_request_target is a very dangerous trigger.
+.github/workflows/squad.md: warning: Both slash_command and bots triggers are configured. If a bot listed in bots: posts a comment that starts with the slash command text (e.g., /command-name), it will trigger the workflow and occupy the concurrency slot, potentially blocking simultaneous manual invocations. To ensure the workflow only runs on explicit user commands, remove the 'bots:' field.
+```
+<!-- compile-warning-allowlist-end -->
+
+The native review advisory includes the compiler's standard explanation and
+Security Lab link. The following guard-policy dry-run lines are informational,
+not another warning. The bot-trigger warning is expected because
+`github-actions[bot]` enables controlled worker-continuation dispatches.
+
+Accept the native review advisory **only while all existing controls remain**:
+same-repository head restriction, base-controlled workflow source,
+`checkout: false` agent path, API-only inspection, exact run/head/attempt guard,
+least-privilege jobs, advisory verdict, and independent human approval.
+`pull_request_target` is not generally safe; this narrow exception neither
+weakens those controls nor authorizes PR-head execution.
+
+**STOP** on any error, or on **any additional warning** beyond these two exact
+documented diagnostics. Also STOP if either warning is missing, duplicated,
+changed, or attributed to another path, if the summary is not
+`Compiled 8 workflows: 8 succeeded, 2 warnings`, or if any required control is
+absent. Do not suppress warnings or use `--approve` to bypass this gate.
 
 ### 6. Require the verifier to prove the complete consumer contract
 

test/gh-aw-enlistment-skill.test.ts

@@ -9,7 +9,7 @@
  *   2. Its frontmatter advertises the documented trigger phrases (discoverability).
  *   3. Its body still encodes every critical safety gate (allowlist, strict
  *      compile, never-auto-merge, read-only token, explicit staging).
- *   4. The canonical source and both template mirrors are byte-for-byte identical
+ *   4. The canonical source and all four mirrors are byte-for-byte identical
  *      (the sync invariant every canonical skill upholds).
  */
 
@@ -42,6 +42,64 @@ function readLF(rel: string): string {
   return readRaw(rel).replace(/\r\n/g, '\n');
 }
 
+const COMPILE_WARNINGS = [
+  '.github/workflows/squad-review.md: warning: pull_request_target is a very dangerous trigger.',
+  ".github/workflows/squad.md: warning: Both slash_command and bots triggers are configured. If a bot listed in bots: posts a comment that starts with the slash command text (e.g., /command-name), it will trigger the workflow and occupy the concurrency slot, potentially blocking simultaneous manual invocations. To ensure the workflow only runs on explicit user commands, remove the 'bots:' field.",
+];
+
+function assertCompileWarningContract(content: string): void {
+  const regions = [...content.matchAll(
+    /^<!-- compile-warning-allowlist-start -->\n```text\n([\s\S]*?)\n```\n<!-- compile-warning-allowlist-end -->$/gm,
+  )];
+  expect(regions).toHaveLength(1);
+  expect(regions[0][1].split('\n')).toEqual(COMPILE_WARNINGS);
+  const flat = content.replace(/\s+/g, ' ');
+  expect(flat).toContain('require exactly two warnings, one occurrence of each exact diagnostic header');
+  expect(flat).toContain('**STOP** on any error, or on **any additional warning** beyond these two exact documented diagnostics.');
+  expect(flat).toContain('Also STOP if either warning is missing, duplicated, changed, or attributed to another path');
+  expect(flat).toContain('Compiled 8 workflows: 8 succeeded, 2 warnings');
+  expect(flat).toContain('or if any required control is absent.');
+  expect(flat).toContain('Do not suppress warnings or use `--approve` to bypass this gate.');
+}
+
+describe.each([CANONICAL, ...MIRRORS, GUIDE])('%s strict compile warning contract', path => {
+  const content = readLF(path);
+
+  it('allows exactly the native review advisory and bot-trigger diagnostic with hard-stop semantics', () => {
+    assertCompileWarningContract(content);
+  });
+
+  it('conditions the native review exception on every existing control', () => {
+    const flat = content.replace(/\s+/g, ' ');
+    expect(flat).toContain('**only while all existing controls remain**');
+    for (const control of [
+      'same-repository head restriction', 'base-controlled workflow source',
+      '`checkout: false` agent path', 'API-only inspection', 'exact run/head/attempt guard',
+      'least-privilege jobs', 'advisory verdict', 'independent human approval',
+    ]) expect(flat).toContain(control);
+    expect(flat).toContain('`pull_request_target` is not generally safe');
+  });
+
+  it.each([
+    ['unknown third warning', `${COMPILE_WARNINGS.join('\n')}\n.github/workflows/squad.md: warning: unknown diagnostic`],
+    ['missing review warning', COMPILE_WARNINGS[1]],
+    ['missing bot warning', COMPILE_WARNINGS[0]],
+    ['duplicate warning', `${COMPILE_WARNINGS.join('\n')}\n${COMPILE_WARNINGS[0]}`],
+    ['different workflow path', COMPILE_WARNINGS.join('\n').replace('squad-review.md', 'untrusted.md')],
+    ['changed diagnostic', COMPILE_WARNINGS.join('\n').replace('very dangerous', 'safe')],
+  ])('rejects a contract mutation allowing %s', (_label, replacement) => {
+    const mutated = content.replace(COMPILE_WARNINGS.join('\n'), replacement);
+    expect(mutated).not.toBe(content);
+    expect(() => assertCompileWarningContract(mutated)).toThrow();
+  });
+
+  it('rejects removal of the error/additional-warning hard stop', () => {
+    const mutated = content.replace('**STOP** on any error', 'Continue on any error');
+    expect(mutated).not.toBe(content);
+    expect(() => assertCompileWarningContract(mutated)).toThrow();
+  });
+});
+
 describe('gh-aw-enlistment skill', () => {
   it('canonical SKILL.md exists', () => {
     expect(existsSync(resolve(ROOT, CANONICAL)), `${CANONICAL} should exist`).toBe(true);
@@ -169,22 +227,6 @@ describe('gh-aw-enlistment skill', () => {
       expect(content).toMatch(/^gh aw compile --strict(\s+#[^\n]*)?$/m);
     });
 
-    it('permits only the documented bot-trigger warning', () => {
-      expect(content).toMatch(/bot-trigger warning|bot trigger/i);
-    });
-
-    // The permission above is only safe because it is paired with a hard halt
-    // on anything else.  Asserting the allowance alone would keep passing if
-    // the STOP were deleted -- i.e. if the narrow exception silently became a
-    // blanket "warnings are fine".  Assert the gate itself, not just the
-    // carve-out.  Newlines are collapsed first because the sentence wraps.
-    it('halts on any error or any warning beyond the documented one', () => {
-      const flat = content.replace(/\s+/g, ' ');
-      expect(flat).toMatch(
-        /\*\*STOP\*\* on any error, or on \*\*any additional warning\*\* beyond that single documented one\./,
-      );
-    });
-
     it('keeps the default workflow token read-only', () => {
       expect(content).toContain('default_workflow_permissions=read');
     });

workflows/skills/gh-aw-enlistment/SKILL.md

@@ -222,11 +222,33 @@ This must run after any first-install approval and before committing. Success
 criteria:
 
 - All eight workflows compile successfully.
-- The **only** permitted warning is the known `squad.md` bot-trigger warning: it
-  configures both slash-command and `github-actions[bot]` triggers, and the bot
-  trigger is required for controlled worker-continuation dispatches.
-- **STOP** on any error, or on **any additional warning** beyond that single
-  documented one.
+- With gh-aw v0.89.21, require exactly two warnings, one occurrence of each
+  exact diagnostic header below (including its workflow path):
+
+<!-- compile-warning-allowlist-start -->
+```text
+.github/workflows/squad-review.md: warning: pull_request_target is a very dangerous trigger.
+.github/workflows/squad.md: warning: Both slash_command and bots triggers are configured. If a bot listed in bots: posts a comment that starts with the slash command text (e.g., /command-name), it will trigger the workflow and occupy the concurrency slot, potentially blocking simultaneous manual invocations. To ensure the workflow only runs on explicit user commands, remove the 'bots:' field.
+```
+<!-- compile-warning-allowlist-end -->
+
+The native review advisory includes the compiler's standard explanation and
+Security Lab link. The following guard-policy dry-run lines are informational,
+not another warning. The bot-trigger warning is expected because
+`github-actions[bot]` enables controlled worker-continuation dispatches.
+
+Accept the native review advisory **only while all existing controls remain**:
+same-repository head restriction, base-controlled workflow source,
+`checkout: false` agent path, API-only inspection, exact run/head/attempt guard,
+least-privilege jobs, advisory verdict, and independent human approval.
+`pull_request_target` is not generally safe; this narrow exception neither
+weakens those controls nor authorizes PR-head execution.
+
+**STOP** on any error, or on **any additional warning** beyond these two exact
+documented diagnostics. Also STOP if either warning is missing, duplicated,
+changed, or attributed to another path, if the summary is not
+`Compiled 8 workflows: 8 succeeded, 2 warnings`, or if any required control is
+absent. Do not suppress warnings or use `--approve` to bypass this gate.
 
 ### 6. Require the verifier to prove the complete consumer contract